The Capability: Facial recognition,
privacy and regulating new technology

I
By
Dr Monique Mann

n late 2015 the Commonwealth government announced
that a national facial recognition system - the National
Facial Biometrics Matching Capability or simply ‘The
Capability’- would be implemented. This system will use
existing identification documents, such as licences and
passports, to extract and share biometric information between
state, territory and national government databases.
As is often the case in relation to technological
developments, regulation and the legal system have lagged
behind. Given limitations in Australia’s privacy framework,
such as an absence of a constitutional bill of rights or a
privacy tort, there are limited privacy protections in relation to
biometric information, and those that do exist are subject to
carve outs and law enforcement exemptions.
Automated Facial Recognition Technology
AFRT systems digitise, store and compare facial templates
that measure the relative position of facial features. These
processes extend privacy considerations beyond the capture
of photographs as they enable automated sorting, database
storage, information sharing and integration.
AFRT can be used to conduct one-to-one matching
to verify identity, or one-to-many searching of databases
to identify unknown persons. It identifies individuals and
provides a gateway to the large and ever expanding databases
held by government, law enforcement and security agencies.
Further, photographs (and therefore facial templates) from
data rich environments such as social media can be mined

20 | Australian Security Magazine

and integrated into big data used for law enforcement and
security purposes.
AFRT can be conducted from a distance and can be
integrated with existing surveillance systems such as CCTV
(known as ‘Smart CCTV’), enabling tracking through public
places. There have been recent moves to trial a Smart CCTV
system known as ‘iOmniscient’ by Australian councils,
including in a Toowoomba library.
The Capability
The Capability will initially involve the sharing of facial
templates between agencies including the Department of
Foreign Affairs and Trade, the Department of Immigration
and Border Protection, and the Australian Federal Police,
with access expanding to other agencies in time. For example,
the Digital Transformation Agency is considering the
possibly of The Capability forming the foundation of the new
Trusted Digital Identity Framework, which will become the
basis of identification verification for all interactions with
Commonwealth Government systems and services.
However, individuals who consented to providing a
photograph to obtain a passport did not consent to their facial
templates being extracted from that image to be used for law
enforcement, security, intelligence or other purposes. This is an
example of function creep, where information collected for one
purpose is used for secondary purposes for which consent was
neither sought nor obtained.
The Capability is being established in a manner that